PTZ support

[m1k1o]

I would like to add PTZ cam support. I am willing to take my time and implement the API. I have axis PTZ cam. But I don' know the API and I don't have G4 PTZ to sniff for the traffic.

If someone has access to G4 PTZ, could you please sniff the communication between cam and unifi while doing basic things like moving the camera, zooming in, changing presets etc. and let me know the API or simply drop here pcap file.

[JasonGehring]

Hey, I just added some rudimentary PTZ support for Tapo cameras in this pull request. I solved the controls by using brightness and contrast adjustment (stole that from the hikvision implementation).

Having the G4 PTZ API would sure be nice. Much better than this hacky solution. Looking around I found this https://github.com/keshavdv/unifi-cam-proxy/pull/357 maybe he could help you.

I just have access to a G3 Pro which offers Zoom and Click to focus. However, selecting this model in the current version of unifi-cam-proxy does not expose the click to focus feature in the UI and the zoom level goes from 1 to 1. So my best guess is that the camera does not adopt correctly/with all required variables set. That's just a guess however. I have not looked too closely at the way the Unifi side of this project works.

[JustAnotherPU]

I currently have access to a G4 Pro a G4 Pro doorbell and a G4 bullet if any of these can help you guys feel free to drop me a message. I also would like to buy a 4K PTZ POE camera that would be well supported with the proxy.

[m1k1o]

@JasonGehring thanks for the resources. I would rather like to use appropriate controls for that. They are there, available. They just need to be properly exposed/intercepted.

@JustAnotherPU not really, but thanks anyway. It needs to be specifically G4 PTZ to see the API that it uses. To know what the PTZ messages look like so that they could be proxied.

[Strongman8481]

I have access to one and am interested in gathering the necessary information. Is there a particular way or guide to sniff this out? I've used wireshark in the past with varying success (I'm a beginner with that tool). Not sure if that is the method needed to sniff this out.

[m1k1o]

@Strongman8481 That's great news!

You could run pcap and save traffic to a file either directly on your Camera, on the Unifi console or any device that sits between these two (any router or switch). Or you could mirror traffic to the port where the camera is connected and grab this data or create bridge on your computer with two ethernet cards and sniff from there.

Wireshark is the ideal tool, but since all of the target traffic is encrypted you would as well need to download the certificate from the camera an decrypt it.

Alternative would be to use tools like mitmproxy where you set up your camera in a different VLAN and put your server to both new and existing VLAN for your cameras. But you would as well need to handle certificates, so I would recommend you to stay with Wireshark.

We would actually need following data:

• when the IP Camera is registered, what are the attributes for request and response as PRT camera
• when you move with your camera around, what is the payload structure for moving in X and Y direction.
• when you zoom in/out with your camera, what is the payload structure for moving in Z direction.
• when you enable/disable movement (i think there is such option or it only happens when you click on the detail of the camera)

So If you would set up the sniffing, adopt the camera as if it would be used for the first time, click on details, move it to various directions (try hitting the limits so we can see in the data what are those) and zoom it completly in and out. If there are other options you could use them and let us know what were they.

Thanks!

[Strongman8481]

This is helpful. I've been running tcpdump on the NVR Pro and have captured traffic. It seems the traffic is still encrypted. I am not 100% how to decrypt as it looks like TLS 1.3. I'll keep working at it, if you have further guidance I would appreciate any ideas you have. I believe keys live in /data/unifi-core/config for the NVR.

[m1k1o]

TLS 1.3 can be harder to decrypt. You would need ot get the session keys, not sure how to get them from unifi.

Probably easier solution would be to setup custom unifi video controller in docker with custom HTTPs reverse proxy and sniff there.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.